Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,549
detections

Search detections

Filters

Showing 30 of 11,549

Systemd Service Override Configuration File Created

This rule detects the creation or renaming of a new Systemd override configuration file in any of the Systemd service locations for both root and regular users. Systemd override configuration files are configuration files in Linux systems used to override the default Systemd service configuration for a specific service. Malicious actors can leverage systemd override configuration files to achieve persistence by creating or modifying services to execute malicious commands or payloads during

T1543T1543.002

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

LowElastic detection rules

Linux Firewall Rule Creation or Modification

Adversaries may create or modify Linux firewall rules with DROP, ACCEPT, or REJECT actions to affect how a host receives or sends network traffic. This activity may be used to bypass security controls, block defensive tooling, or gain unauthorized access to the network.

T1562T1562.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

LowElastic detection rules

M365 Exchange MFA Notification Email Deleted or Moved

Identifies when an MFA enrollment, registration, or security notification email is deleted or moved to deleted items in Microsoft 365 Exchange. Adversaries who compromise accounts and register their own MFA device often delete the notification emails to cover their tracks and prevent the legitimate user from noticing the unauthorized change. This technique is commonly observed in business email compromise (BEC) and account takeover attacks.

T1070T1070.008T1098T1098.005

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

Azure AKS Multi-Resource Setup Discovery

Detects an AKS (Azure Kubernetes Service) identity that lists or gets multiple distinct Kubernetes API resource types associated with cluster orientation (namespaces, nodes, pods, roles, clusterroles, configmaps, serviceaccounts, rolebindings, clusterrolebindings) within a short window. Cardinality of distinct resources touched, not raw event count, is the signal that separates recon/orientation behavior from steady-state controllers that repeatedly touch a narrow set of resources.

T1613

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Suspicious Assignment of Controller Service Account

This rule detects a request to attach a controller service account to an existing or new pod running in the kube-system namespace. By default, controllers running as part of the API Server utilize admin-equivalent service accounts hosted in the kube-system namespace. Controller service accounts aren't normally assigned to running pods and could indicate adversary behavior within the cluster.

T1078T1078.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Service Account Modified RBAC Objects

Detects write operations performed by Kubernetes service accounts against RBAC resources (Roles, ClusterRoles, RoleBindings, ClusterRoleBindings). Service accounts typically do not manage RBAC directly; this activity may indicate token abuse, misconfigured permissions, or unauthorized privilege escalation.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

LowElastic detection rules

AWS EKS Unusual Kubernetes Sensitive Workload Modification

Detects the creation or modification of several sensitive workloads, such as DaemonSets, Deployments, or CronJobs, by an unusual user agent, source IP and username, which may indicate privilege escalation or unauthorized access within the cluster.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Sensitive RBAC Change Followed by Workload Modification

Detects a sequence where a principal creates or modifies a Role/ClusterRole to include high-risk permissions (e.g., wildcard access or escalation verbs) and then creates or patches a workload resource (DaemonSet, Deployment, or CronJob) shortly after, which may indicate RBAC-based privilege escalation followed by payload deployment. This pattern is often used by adversaries to gain unauthorized access to sensitive resources and deploy malicious payloads.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

HighElastic detection rules

AWS EKS RBAC Wildcard Elevation on Existing Role

Flags an existing Role or ClusterRole being changed (patch or update) to a wildcard on every API resource and verb. This may be indicative of a deliberate privilege expansion but may also be a nefarious attempt at privilege escalation.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Privileged Pod Created

This rule detects when a user creates a pod/container running in privileged mode. A highly privileged container has access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the privileged container to gain access to the underlying host. Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command

T1610T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Pod Created with a Sensitive hostPath Volume

This rule detects when a pod is created with a sensitive volume of type hostPath. A hostPath volume type mounts a sensitive file or folder from the node to the container. If the container gets compromised, the attacker can use this mount for gaining access to the node. There are many ways a container with unrestricted access to the host filesystem can escalate privileges, including reading data from other containers, and accessing tokens of more privileged pods.

T1610T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Pod Created With HostPID

This rule detects an attempt to create or modify a pod attached to the host PID namespace. HostPID allows a pod to access all the processes running on the host and could allow an attacker to take malicious action. When paired with ptrace this can be used to escalate privileges outside of the container. When paired with a privileged container, the pod can see all of the processes on the host. An attacker can enter the init system (PID 1) on the host.

T1610T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Pod Created With HostNetwork

This rules detects an attempt to create or modify a pod attached to the host network. HostNetwork allows a pod to use the node network namespace. Doing so gives the pod access to any service running on localhost of the host. An attacker could use this access to snoop on network activity of other pods on the same node or bypass restrictive network policies applied to its given namespace.

T1610T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Pod Created With HostIPC

This rule detects an attempt to create or modify a pod using the host IPC namespace. This gives access to data used by any pod that also use the hosts IPC namespace. If any process on the host or any processes in a pod uses the hosts inter-process communication mechanisms (shared memory, semaphore arrays, message queues, etc.), an attacker can read/write to those same mechanisms. They may look for files in /dev/shm or use ipcs to check for any IPC facilities being used.

T1610T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Ephemeral Container Added to Pod

Detects allowed updates to the pods/ephemeralcontainers subresource by a non-system identity. Ephemeral containers are commonly used for debugging (kubectl debug) but can also be abused to inject tooling into a running pod, access mounted secrets, and execute commands in the target pod context. Attackers with sufficient RBAC may use ephemeral containers to escalate privileges, move laterally, or establish persistence without deploying a new workload.

T1609T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

HighElastic detection rules

AWS EKS API Request Impersonating Privileged Identity

Detects Kubernetes API requests where a user is impersonating a privileged cluster identity such as system:kube-controller-manager, system:admin, system:anonymous, or a member of the system:masters group. These identities have broad cluster-wide permissions including unrestricted access to all secrets, the ability to create tokens for any service account, schedule pods on any node, and modify RBAC policies.

T1134

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Container Created with Excessive Linux Capabilities

This rule detects a container deployed with one or more dangerously permissive Linux capabilities. An attacker with the ability to deploy a container with added capabilities could use this for further execution, lateral movement, or privilege escalation within a cluster. The capabilities detected in this rule have been used in container escapes to the host machine.

T1610T1611

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS API Server Proxying Request to Kubelet

Detects non-system identities using the Kubernetes nodes/proxy API to proxy requests through the API server directly to a node's Kubelet. The nodes/proxy subresource allows any principal with this RBAC permission to reach the Kubelet API on any worker node without needing direct network access or Kubelet TLS certificates. Through this proxy path, an attacker can list all pod specifications including environment variable secrets, read Kubelet configuration and PKI material, retrieve container

T1550T1550.001T1611T1613

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Creation of a RoleBinding Referencing a ServiceAccount

This rule detects the creation of RoleBindings or ClusterRoleBindings that reference a ServiceAccount, which may indicate privilege delegation or potential RBAC misconfiguration leading to elevated access.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Creation or Modification of Sensitive Role

Detects the creation or modification of Kubernetes Roles or ClusterRoles that grant high-risk permissions, such as wildcard access or RBAC escalation verbs (e.g., bind, escalate, impersonate), which may enable privilege escalation or unauthorized access within the cluster.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

HighElastic detection rules

AWS EKS Authentication Configuration Modified

Detects modifications to the aws-auth ConfigMap in Amazon EKS clusters. The aws-auth ConfigMap maps AWS IAM roles and users to Kubernetes RBAC groups, an attacker who modifies it can grant any IAM role cluster-admin access by adding a mapping to the system:masters group. This is a well-documented persistence technique that survives pod restarts, node replacements, and RBAC changes because the authentication mapping exists outside of normal Kubernetes Role objects.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

HighElastic detection rules

AWS EKS Client Certificate Signing Request Created or Approved

Detects creation or approval of a Kubernetes CertificateSigningRequest (CSR) by a non-system identity. Attackers who have gained cluster access can submit a CSR with a privileged Common Name such as system:kube-controller-manager or system:masters, then approve it themselves to obtain a long-lived client certificate. Unlike service account tokens which expire in hours, client certificates persist until they expire or the cluster CA is rotated, providing durable access that survives pod

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Admission Webhook Created or Modified

Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server.

T1546T1562

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Exposed Service Created With Type NodePort

This rule detects an attempt to create or modify a service as type NodePort. The NodePort service allows a user to externally expose a set of labeled pods to the internet. This creates an open port on every worker node in the cluster that has a pod for that service. When external traffic is received on that open port, it directs it to the specific pod through the service representing it.

T1133

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Cluster-Admin Role Binding Created

This rule detects the creation of a RoleBinding or ClusterRoleBinding that grants the cluster-admin ClusterRole, which provides unrestricted access to all Kubernetes resources and represents a high-risk privilege escalation or misconfiguration.

T1098T1098.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS Anonymous Request Authorized by Unusual User Agent

This rule detects when an unauthenticated user request is authorized within the cluster via an unusual user agent. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez, /version and /.well-known/oauth-authorization-server endpoints which are commonly accessed anonymously.

T1078T1078.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

HighElastic detection rules

AWS EKS CoreDNS or Kube-DNS Configuration Modified

Detects modifications to the CoreDNS or kube-dns ConfigMap in the kube-system namespace. These ConfigMaps control cluster DNS resolution for all pods. An attacker who modifies the CoreDNS Corefile can redirect internal service DNS names to attacker-controlled IP addresses, enabling man-in-the-middle attacks against the Kubernetes API server, database services, and other internal endpoints.

T1565T1565.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

MediumElastic detection rules

AWS EKS User Exec into Pod

This rule detects a user attempt to establish a shell session into a pod using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod. An adversary may call bash to gain a persistent interactive shell which will allow access to any data the pod has permissions to, including secrets.

T1609

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

LowElastic detection rules

AWS EKS Unusual Decision by User Agent

This rule detects unusual request responses in Kubernetes audit logs through the use of the "new_terms" rule type. In production environments, default API requests are typically made by system components or trusted users, who are expected to have a consistent user agent and allowed response annotations. By monitoring for anomalies in the username and response annotations, this rule helps identify potential unauthorized access or misconfigurations in the Kubernetes environment.

T1078

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

HighElastic detection rules

AWS EKS Pod Exec Potential Reverse Shell

Flags exec into a pod when the URL-decoded command payload resembles reverse-shell or bind-shell one-liners invocation patterns. Legitimate debug sessions sometimes use similar building blocks, but together these patterns align with post-exploitation interactive access and command-and-control.

T1059T1609

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 22, 2026

Load more detections

Loading detection rules

Back to results

MediumSigmaHQ Shoban Chiddarth

AWS Bucket Block Public Access Weakened

Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs. Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a…

Description

Detection logic

Detection requirements

Platform: IaaS
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: aws
Log source service: cloudtrail

Known benign triggers

Administrators intentionally modifying Block Public Access settings to support a legitimate application or public bucket configuration.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Defense Impairment

T1686Disable or Modify System Firewall
- T1686.001Cloud Firewall 14 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html	Product documentation	Only this detection cites it
docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html	Product documentation	3from 2 sources

From the source

At source: Open at source
Upstream identifier: ab18a523-e093-4ac6-8303-8c47431f4fca
Tagged by the source as: attack.defense-impairment

Licence

Published under: Detection Rule License 1.1Read the licence
Attribution: Required

Authorship

Written by: Shoban Chiddarth
Published: Oct 22, 2026
Version: 1